Solution: Do Not Rely Solely On Modsecurity To Block Attacks.
Stefan Esser of the Hardened-PHP Project posted a security advisory of a flaw in ModSecurity regarding POST Data NULL Byte Rule Bypass.
The problem is that it is possible to bypass rules by adding NULL bytes to POST data with the application/x-www-form-urlencoded media type.
Now the funny part:
SOLUTION:
Do not rely solely on ModSecurity to block attacks.
ModSecurity isn’t a magical anti-hack solution, and the people who use it know that. Kinda stating a very obvious fix. How about “turn off scripting” :) [IE]
Steven.